Converge and enforce the declared subordinate-ID width#35
Merged
Conversation
A structured fact parses /etc/subuid and /etc/subgid into per-file owner maps, so the class can compare the declared range against real host state that rspec and --noop cannot see. The parsing is a pure PuppetX module, unit-tested without Facter or the filesystem; the fact is a thin adapter.
subid_count becomes a declared minimum width the module enforces per file. When the runner user's range is the module-owned one but narrower than declared, a single locked usermod rewrites it wider (del-before-add), and the rootless daemon is restarted so the new user namespace takes effect. The preflight now sums the runner's ranges against the declared count, so a too-narrow foreign range fails loud instead of failing later in a job. Every host/data divergence the module neither converges nor fails warns each apply, including a declared range overlapping another user; only the exact-match state is silent. Decisions read from the structured subid fact, so the usermod commands are literal and guards test host state.
Correct the rootless_docker.manage option: subid_count is now a declared minimum width enforced grow-only, not a create-only value left untouched once set. Note the shadow auto-allocation collision at subid_start and the compile-time overlap advisory. REFERENCE.md regenerated to match.
Replace the stale never-overwritten claim in the rootless_docker section with the grow-only contract: a narrow module-owned range is widened in place and the rootless daemon restarted, a foreign or wider range is left alone, and the restart interrupts running jobs. The preflight now asserts the declared subid_count, not a fixed 65,536.
…dth-enforcement # Conflicts: # CHANGELOG.md
jcardozo-eth
added
breaking
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes #15. The default-width bump was delivered in #20 (merged); this PR adds the enforcement part: a declared range is now converged, the preflight checks it, and divergences are surfaced.
What changes
rootless_docker.subid_countbecomes a declared minimum width the module enforces per file, only ever widening a range and never shrinking one:lib/puppet_x/rootless_gitlab_runner/subids.rb, read through a thinlib/facteradapter) parses/etc/subuidand/etc/subgidinto a per-owner map, so the catalog can reason about real host state that a compile and--noopcannot see.subid_count, a single lockedusermod(del-before-add) widens it in place, and a refreshonly restart of the rootless daemon fires so its user namespace picks up the new width. The old width comes from the fact, so the command is literal. A foreign-start or already-wider range is never rewritten.Tests
Each row of the divergence case matrix is exercised at non-default values with the fact supplied directly (rspec cannot see host state), and the key assertions are mutation-checked.
Verification
just checkgreen: validate + lint + 142 examples, 0 failures + docs-check PASS.